-2
$\begingroup$

I only know of some security models:

rom->crs->std

How about others? Or may it be different in several fields?

Thanks.

$\endgroup$

1 Answer 1

13
$\begingroup$

What you are asking for is not really a list of security models, but more a list of idealized models (like the ROM), and trust assumptions (like the CRS model). Asking for a list seems a bit off-topic to me, and the question is a bit vague.

Anyway, many idealized models and trust models are common in cryptography, and things are in general not as simple as "random oracle model". Here's a non-exhaustive list:

Idealized models:

  • The programmable random oracle model (where the simulator can program its output ou inputs of its choice)
  • The non-programmable ROM (sometimes used together with a CRS)
  • The global ROM (used in the UC model to allow for composition theorems)
  • The ideal block cipher model, common in symmetric cryptography
  • The quantum ROM, where queries can be in superposition
  • The auxiliary-input ROM, which models the fact that a party could have informations hardcoded about a hash function (e.g. a collision)

Trust assumptions:

  • The common random string model
  • The common reference string model (where the CRS is drawn from some fixed distribution, which is not necessarily uniform)
  • The registered key model, a weakening of the previous one, where each player registers some key pair with some authority that it trusts
  • The tamper proof hardware token model, where players are given trusted pieces of hardware that can execute some computation

This is just a sample. In general, coming up with an idealized model is a common way to heuristically reason about constructions for which a direct reduction to a hard mathematical problem seems unlikely. While the programmable ROM is very common, there are many alternatives, and also many ways to weaken it, so that it shares more similarities with our "real world" hash functions. Similarly, it is very common also to come up with some minimal trust assumption to get around impossibility results, and while the common random string model is often used, in many scenarios alternative simple trust assumptions can be easily motivated.

$\endgroup$
4
  • $\begingroup$ No Generic groups? Generic rings? Ideal graded encodings? $\endgroup$
    – Maeher
    Commented Feb 28, 2018 at 13:31
  • $\begingroup$ As I stated, "this is just a sample" of possible idealized model. But yes, the list of idealized ways of modelling groups is very relevant to the question; feel free to either add it as a separate, complementary answer, ord edit my answer to make it a bit more exhaustive. $\endgroup$ Commented Feb 28, 2018 at 13:33
  • $\begingroup$ So I can't verify which algorithm is more secure just by models (rom/crs)? $\endgroup$
    – p1gd0g
    Commented Feb 28, 2018 at 14:29
  • $\begingroup$ You cannot really compare both. A protocol secure in the ROM is not necessarily "secure in practice" when the RO is replaced by any real hash function (in some contrived cases, it might be provably insecure for any hash function). A security proof in the ROM is at best a heuristic indication that finding an attack will be hard. In contrast, a security proof in the CRS model is perfectly fine: it shows that the protocol is secure, assuming that the CRS was set up in a trusted way. However, it says nothing about how to setup the CRS in practice, or how to enforce that it was done honestly. $\endgroup$ Commented Feb 28, 2018 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.